PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64432 Linux CVE debrief

A slab-out-of-bounds write vulnerability exists in the Linux kernel's ntfs3 filesystem implementation. The issue arises during the analysis pass of $LogFile journal replay in log_replay(), where LCNs are copied from each action log record into an existing Dirty Page Table (DPT) entry without proper bounds checking on the destination index. This can be triggered by a crafted NTFS image with a DPT entry lcns_follow=1 and an action log record with lcns_follow=2, leading to a kernel slab out-of-bounds write at mount time.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-25
Original CVE updated
2026-10-19
Advisory published
2026-07-25
Advisory updated
2026-10-19

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, system administrators responsible for Linux systems, security teams monitoring Linux system vulnerabilities.

Why it matters

CVE-2026-64432 is a high-severity vulnerability in the Linux kernel's ntfs3 filesystem implementation. It allows for slab-out-of-bounds writes, potentially leading to local privilege escalation or DoS. Defenders should prioritize patching and verifying NTFS image integrity.

  • Local attackers may exploit this vulnerability to escalate privileges or cause a denial-of-service (DoS) on affected Linux systems.
  • Successful exploitation could lead to kernel crashes or potentially allow for local privilege escalation.
  • Defenders should prioritize patching affected systems, especially those exposed to untrusted sources.
  • Verification of NTFS image integrity before mounting is crucial to prevent exploitation.

Technical summary

The vulnerability exists in the log_replay() function of the Linux kernel's ntfs3 filesystem implementation. It occurs when LCNs are copied from action log records into a Dirty Page Table (DPT) entry without validating the destination index. This can lead to a slab-out-of-bounds write when a crafted NTFS image with specific DPT and action log record settings is mounted. The issue allows for potential local privilege escalation or denial-of-service (DoS) attacks. Defenders should prioritize patching affected systems and verifying NTFS image integrity before mounting.

Defensive priority

High

Recommended defensive actions

  • Review and apply the provided source code patches to affected Linux kernel versions.
  • Update Linux kernel to versions 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or later.
  • Verify the integrity of NTFS images before mounting them.
  • Monitor Linux kernel updates for potential security patches.
  • Perform vulnerability scanning to identify exposed systems.
  • Implement compensating controls for exposed systems while remediation is scheduled.
  • Track remediation progress and verify fixes.

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. However, specific details about exploitation or victim impact are not provided.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-64432 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-64432

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-64432 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-64432

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/64xxx/CVE-2026-64432.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/964c3fae1dfc49dde5468eace940f199cda234e9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/3aa96956ca2200674e2a8f9c23ec6ecd45e5010f

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/946046841013ebac8492ef49651c53638d7a9a6a

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c6f9e804f73ef809529865fbc7256dd189ff8c33

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cf28fc1658463d768657cf1c27a83980d4ba7ef2

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f433acc85b86f327d03ba8b03a33c105c51053de

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/57382ec6ac63b63dce2789e835fded28b698ae79

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.